| Package | Affected versions | Patched versions |
|---|---|---|
| actionpack | ≥ 4.0.0, < 4.2.5.1 | 4.2.5.1 |
| rails | = 4.0.0= 4.0.1= 4.0.10= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6= 4.0.7= 4.0.8= 4.0.9= 4.1.0= 4.1.1= 4.1.2= 4.1.3= 4.1.4= 4.1.5= 4.1.6= 4.1.7= 4.1.8= 4.2.0= 4.2.1= 4.2.2= 4.2.3= 4.2.4= 4.2.5= 5.0.0 |
actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free